valitydev/SigmaHQ
14
0
Fork 0
mirror of https://github.com/valitydev/SigmaHQ.git synced 2024-11-07 01:45:21 +00:00
Code Issues Actions Packages Projects Releases Wiki Activity

Fix multiple references to default field mapping in same rule

Browse Source 
If there is a default mapping specified for a fieldmapping and that field is
referenced multiple times in the rule, the default mapping will be "pop"ped
and return the unmapped key on subsequent uses.

Don't pop the value. Just return the first entry.
This commit is contained in:
Brad Kish 2020-06-18 13:01:31 -04:00
parent d24ec665fd
commit 203aa192c7
1 changed files with 2 additions and 2 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

4
tools/sigma/config/mapping.py
View File

@ -125,9 +125,9 @@ class ConditionalFieldMapping(SimpleFieldMapping):
if len(targets) == 1: # result set contains only one target, return mapped item (like SimpleFieldMapping)
if value is None:
return ConditionNULLValue(val=targets.pop())
return ConditionNULLValue(val=targets[0])
else:
return (targets.pop(), value)
return (targets[0], value)
elif len(targets) > 1: # result set contains multiple targets, return all linked as OR condition (like MultiFieldMapping)
cond = ConditionOR()
for target in targets: